Hello,
I am sharing the confirmed results of a PoC involving Autonomous Database Serverless, OML4Py, and OCI IAM DB Token authentication.
The requirement was to allow engineering users to authenticate exclusively through OCI IAM, without distributing local database passwords.
Tested configuration
- ADB-S ATP 26ai with Private Endpoint
- Database schema mapped to OCI IAM through IDENTIFIED GLOBALLY
- python-oracledb in Thick mode with the oci_tokens authentication plugin
- Database connection authenticated with an OCI IAM DB Token
- AUTHENTICATION_METHOD = TOKEN_GLOBAL
- Schema enabled for OML through Database Actions
- OML_DEVELOPER, PYQADMIN, and DWROLE granted
- Required OML4Py host ACE configured
What works with OCI IAM DB Token
The following operations worked correctly with the IAM-mapped schema:
- Database connection through python-oracledb and OCI IAM DB Token
- SQL and PL/SQL
- DBMS_DATA_MINING
- Queries and cursors through the IAM-authenticated connection
- oml.core.methods.set_connection(conn, reset=True)
- oml.isconnected() returning True
- oml.cursor()
- sys.pyqScriptCreate()
- Script persistence and visibility in USER_PYQ_SCRIPTS and ALL_PYQ_SCRIPTS
These results confirmed that OCI IAM DB Token authentication, IAM schema mapping, the database session, OML enablement, grants, the host ACE, and the SQL script repository were correctly configured.
Embedded Python Execution limitation
pyqEval and the other pyq* execution functions did not work with the pure IAM identity.
Without an OML broker token, pyqEval returned:
ORA-20101: token not found
The currently available OML broker token is obtained from:
/omlusers/api/oauth2/v1/token
using grant_type=password and the credentials of a local OML-enabled database user.
After setting that token in the IAM-authenticated database session through pyqSetAuthToken(), the token was accepted, but pyqEval still could not execute the script created by the IAM-mapped schema.
The script existed and was visible in USER_PYQ_SCRIPTS and ALL_PYQ_SCRIPTS, but execution failed with ORA-20100 because the Embedded Python Execution runtime operated under a different identity context.
A REST repository test confirmed the same behavior: the broker token exposed scripts associated with the local database identity used to obtain the token, including PYQSYS objects, but not the scripts owned by the IAM-mapped schema.
The flow therefore contains two different identities:
1. The IAM-mapped schema authenticated through the OCI IAM DB Token, which creates and owns the script.
2. The local database user associated with the OML broker token.
Embedded Python Execution uses the broker-token identity, which does not match the IAM-mapped schema identity.
OML4Py Python client tests
The OML4Py client connection paths were also tested.
IAM and token-related parameters were rejected by oml.connect() at runtime:
oml.connect(dsn=..., access_token=...)
TypeError: connect() got unexpected keyword arguments ['access_token']
oml.connect(dsn=..., extra_auth_params=...)
TypeError: connect() got unexpected keyword arguments ['extra_auth_params']
externalauth was also not accepted as a usable authentication parameter for this scenario.
The following path was then tested:
oml.core.methods.set_connection(conn, reset=True)
It successfully attached the existing python-oracledb connection authenticated with the OCI IAM DB Token.
It enabled:
- oml.isconnected()
- oml.cursor()
- SQL query execution
It did not enable Embedded Python Execution.
A call to oml.do_eval() returned:
ValueError: embed connection is not enabled
Confirmed conclusion
With OCI IAM DB Token authentication, the following capabilities were successfully tested:
- Database-plane access
- SQL and PL/SQL
- DBMS_DATA_MINING
- python-oracledb Thick connections
- OML4Py queries and cursors through set_connection()
- pyqScriptCreate and the SQL script repository
Embedded Python Execution is not currently available through a pure IAM flow using:
- pyqEval and the other pyq* execution functions
- OML REST runtime APIs
- The OML4Py Python client
A successful pyqScriptCreate call must therefore not be interpreted as evidence that pyqEval or Embedded Python Execution works with the same OCI IAM DB Token identity.
Oracle Engineering confirmed that set_connection() attaches the database session but does not initialize the server-side Embedded Python Execution path for IAM or token-based authentication. Product changes are required.
Oracle logged the following Enhancement Request:
Enhancement 39271272
OML4PY IAM TOKEN AUTHENTICATION SUPPORT
Architectural impact
In the current implementation:
- Engineering users can use OCI IAM DB Token authentication for database operations and ML capabilities available through SQL, PL/SQL, and DBMS_DATA_MINING.
- Embedded Python Execution still requires a local database identity associated with an OML broker token.
- OML Notebooks and other OML components using the OML OAuth2 authentication layer do not become IAM-enabled through database IAM authentication alone.
- Custom ORDS APIs protected by OCI IAM JWT can mediate controlled backend operations using a server-side local OML account, but this is an application mediation pattern. It does not provide native OML4Py authentication through OCI IAM DB Token.
I am sharing these findings to clearly distinguish successful OCI IAM DB Token database authentication and SQL script-repository access from end-to-end OML4Py Embedded Python Execution support.